MEDIUM6.5

GHSA-q4g7-jrxv-67r9

Silent Configuration Failure in Puppet Agent

Quick fix

GHSA-q4g7-jrxv-67r9 — puppet: upgrade to the fixed version with the command below.

bundle update puppet

Details

A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/puppet

Introduced in: 7.0.0Fixed in: 7.12.1

Fixbundle update puppet

RubyGems/puppet

Introduced in: 0Fixed in: 6.25.1

Fixbundle update puppet

References

https://nvd.nist.gov/vuln/detail/CVE-2021-27025[ADVISORY]
https://github.com/puppetlabs/puppet[PACKAGE]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2021-27025.yml[WEB]
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7[WEB]
https://puppet.com/security/cve/cve-2021-27025[WEB]